StepLeague Privacy Policy

This Privacy Policy explains how FlashSoft OÜ ("FlashSoft," "we," "us," or "our") processes information when you use StepLeague (the "App"). FlashSoft OÜ is an Estonian private limited company, registry code 16941816, with a registered address at Ruunaoja tn 3, Lasnamäe linnaosa, Tallinn, Harju maakond 11415, Estonia.

Contact: contact@flashsoftapps.com

1. Summary of Our Commitments

• Health and fitness access is optional and controlled through Apple Health permissions.
• Your detailed Apple Health records remain in Apple Health. The App reads only the categories you authorize.
• Step and floor totals are uploaded for leagues and friend comparisons only when you choose to participate and Private Mode is off.
• We do not sell HealthKit data or use it for advertising, profiling, marketing, or unrelated data mining.
• Location is requested to determine a city and country; we do not build a GPS location history or track you in the background.
• StepLeague has no free-form chat, comments, photo sharing, or direct messages. Social interaction is limited to preset emoji reactions subject to rate limits.

This summary is not a substitute for the complete policy below.

2. Information We Process

2.1 Apple Health and Fitness Information

With your permission, the App may read:

• step count;
• flights climbed;
• active energy burned; and
• workout records, including the existence and basic properties of workouts needed for App features.

We use this information to calculate and display progress, statistics, daily goals, streaks, achievements, estimated distance, calories, active time, leagues, and fraud-prevention signals. Some displayed values are estimates and may not match medical or fitness equipment.

Apple Health controls authorization. You may grant or deny each category and revoke access in iOS Settings or the Health app. StepLeague cannot determine whether a category contains no data or whether you denied access where Apple deliberately withholds that distinction.

Health information used only for personal dashboards is processed on your device. We do not upload raw HealthKit samples, workout routes, or a continuous HealthKit history. If you enable league participation, the sharing described in Section 2.3 applies.

2.2 Information Stored on Your Device

The App stores settings and personal app state locally, which may include goals, cached statistics, streak state, achievements, league preferences, privacy choices, onboarding state, and other interface preferences. This information may be included in device backups according to your Apple and iOS settings.

Deleting the App generally deletes its local data, but does not delete information already synchronized to our service, Apple Health records, Apple backups, or information retained by service providers. Use the in-app account deletion function or contact us to request deletion of server-side account data.

2.3 Optional League and Friend Information

When you join competitions and Private Mode is off, we may upload:

• your pseudonymous account identifier;
• calendar date, daily step total, and daily floors climbed;
• up to 30 days of historical daily totals during an initial history synchronization;
• nickname, city, country, friend code, and optional preset emoji avatar;
• league, friend, privacy, and goal settings; and
• streak, achievement, and progress state used to operate and protect the competition.

This information is pseudonymous, not necessarily anonymous. Although StepLeague does not require your legal name, a persistent identifier, nickname, city, friends, device information, or account credential can make information personal data under applicable law.

Leaderboard and friend views may show other users your nickname, avatar, city or country, rank, step total, floors, streak, and related competition status, depending on the feature and your settings. Do not use a nickname that reveals information you do not want others to see.

Private Mode prevents your step and floor totals from being submitted to StepLeague leagues and hides you from competitive views. It does not by itself disable every non-health service, such as diagnostics, purchases, security, or basic analytics. You can revoke Apple Health access separately.

2.4 Location

With permission, the App requests a location fix while you use it and uses Apple's location and reverse-geocoding services to determine your city and country for local leagues. We do not intentionally store precise latitude or longitude on our servers, maintain a route history, or track location in the background. City and country may be stored with your profile and shown in relevant league views.

Location results can be inaccurate. You may deny or revoke location access; local league features may then be unavailable or less accurate.

2.5 Account and Sign-In Information

We create an anonymous-authentication account with a random identifier. If you choose Sign in with Apple to link or recover your account, we may receive an Apple account identifier and, depending on your Apple choices, your email address or Apple's private relay address and name. Apple processes the sign-in under its own terms and privacy policy.

2.6 Friends, Reactions, and Safety Reports

If you add friends or participate socially, we process friend codes, friendship records, requests, preset emoji reactions, sender and recipient identifiers, and timestamps. There is no free-form user-to-user messaging. Emoji reactions are rate-limited; the current service permits one reaction from a sender to the same recipient per calendar day, and limits may change to prevent abuse.

If you report a user, we process the report, relevant account identifiers, reason, and status to review abuse, protect users, and enforce our terms.

2.7 Motion, Camera, and Notifications

• Motion & Fitness: the App may examine motion/activity signals on the device to detect implausible step activity and protect leagues. Raw motion signals are not intentionally uploaded. A flagged day may be excluded from streaks, achievements, or rankings.
• Camera: camera access is used to scan StepLeague friend QR codes. Camera frames are processed on the device and are not intentionally uploaded.
• Notifications: if enabled, we and our notification providers process a push token, delivery information, and notification preferences. Apple also processes notification data.

2.8 Purchases and Subscriptions

Apple processes payments. We and our subscription provider may receive a transaction or entitlement identifier, product purchased, subscription status, renewal/expiration information, price/currency metadata, and related receipt information. We do not receive your full payment-card number from Apple.

2.9 Analytics, Diagnostics, and Device Information

We use analytics and crash-reporting tools to understand feature use, diagnose errors, measure performance, prevent abuse, and improve the App. They may process a pseudonymous user or installation identifier, app interactions, session events, crash logs, diagnostics, app version, device model, operating-system version, language, IP-derived general region, timestamps, and network information. Do not include sensitive personal information in support messages.

2.10 Advertising and Tracking Choices

The App may display advertisements supplied by third-party advertising services. Depending on your region, consent, device settings, and the provider used, ad services may process IP address, coarse region, device and app identifiers, advertising identifier (IDFA), ad impressions, clicks, conversions, fraud signals, and diagnostics to deliver, cap, secure, and measure ads.

Where Apple App Tracking Transparency authorization is required, IDFA or cross-company tracking is used only after you authorize it. Denying tracking does not necessarily remove ads; it generally makes them contextual or less personalized. You can change tracking permission in iOS Settings. Any additional consent required by local law will be requested separately.

We do not provide Apple Health data, step or floor totals, workout data, calories, precise location, or league performance to advertising platforms for targeting, measurement, marketing, or profiling. We do not allow an advertiser to combine such data with its own data. Our advertising providers must not infer health information from your use of the App.

The specific advertising provider(s), their privacy links, and exact data practices will be disclosed in this policy and the App Store privacy label before the relevant advertising integration is released.

2.11 Support Communications

If you contact support, we process your email address, optional name, message, selected category, and technical context such as App version, device model, and iOS version to answer and maintain a support record.

3. Why We Process Information and Our Legal Bases

Where GDPR or similar law applies, we rely on:

You may withdraw consent at any time without affecting processing already lawfully performed. Some features cannot work without the information they require.

4. How We Disclose Information

We disclose information only as needed to operate the App:

• Other StepLeague users: the league, friend, profile, and reaction information described above.
• Supabase: authentication, database, and backend infrastructure.
• Apple: HealthKit, Sign in with Apple, StoreKit, push notifications, location/reverse geocoding, and platform operation.
• Apphud: subscription entitlement and purchase analytics.
• Google Firebase: analytics and crash reporting.
• Amplitude: product analytics.
• Advertising provider(s): only the advertising/device information described in Section 2.10, and never HealthKit or league fitness data.
• Support and hosting providers: to deliver messages, host pages and infrastructure, and protect the service.
• Authorities or transaction parties: where reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a merger, financing, reorganization, or sale, subject to appropriate safeguards.

Providers process information under their own terms and, where they act for us, contractual privacy and security obligations. Their current policies include Apple, Supabase, Apphud, Google, and Amplitude.

We do not sell Apple Health data. We do not knowingly sell personal information for money. If an advertising practice constitutes "sharing," "targeted advertising," or a "sale" under applicable law, we will provide the required notice and opt-out or consent mechanism before using it.

5. Retention

We retain information only for as long as reasonably necessary for the purposes above:

• local information remains until removed through the App, deletion of the App, or device/backup controls;
• active account, league, friend, and entitlement data remains while the account is active;
• account deletion removes or de-identifies server account data, subject to backup cycles, fraud prevention, legal duties, disputes, and transaction records we must retain;
• support, security, and diagnostic records are kept for a limited period appropriate to their purpose; and
• providers may retain data under their documented schedules and legal obligations.

We do not promise instant deletion from encrypted backups. Data isolated in backups is not returned to active use and is deleted through the normal backup lifecycle unless law requires longer retention.

6. Your Choices and Rights

You can:

• control Apple Health, location, motion, camera, notification, and tracking permissions in iOS Settings;
• enable Private Mode to stop sharing step/floor totals with leagues;
• change eligible profile and competition settings in the App;
• manage subscriptions in your Apple ID subscription settings;
• use the in-app account deletion feature; and
• contact us to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or an advertising privacy choice where applicable.

We may need to verify a request and may retain information where law permits or requires. EEA/UK users may complain to their local supervisory authority; in Estonia, this is the Andmekaitse Inspektsioon. California residents may have rights to know, correct, delete, and opt out of sale/sharing, and not to be discriminated against for exercising those rights. We will honor applicable rights and authorized-agent requests as required by law.

7. International Transfers

FlashSoft is based in Estonia, while providers may process information in the EEA, United States, or other countries. Where required, we use recognized safeguards such as adequacy decisions, Standard Contractual Clauses, or provider certifications, together with supplementary protections as appropriate.

8. Security

We use reasonable administrative, technical, and organizational safeguards, including platform security, access controls, and encrypted network transport where supported. No system is completely secure. You are responsible for protecting your device and account credentials. Notify us promptly if you suspect unauthorized access.

9. Children

StepLeague is not directed to children under 13, or a higher minimum age required in their country. We do not knowingly collect personal information from a child below the applicable age without legally valid parental authorization. If you believe this occurred, contact us so we can investigate and delete the information where required. The App must not use personalized advertising for users where age or local law prohibits it.

10. Third-Party Links and Services

Ads, support pages, or other features may link to third-party services. Their privacy practices are governed by their own notices. We are not responsible for their independent practices, but you may report an inappropriate advertisement to us.

11. Changes to This Policy

We may update this policy as the App, providers, or law changes. We will change the date above and provide additional notice or obtain renewed consent where required. Material changes do not retroactively reduce your rights without a lawful basis.

12. Contact

Email: contact@flashsoftapps.com

Privacy requests should use the subject line "StepLeague Privacy Request."